This Policy has been prepared in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95 /46/EO (Regulation),
General
Art. 1. Nikolay Zdravkov, phone +359887971010, e-mail info@seaviewranch.com operates “Sea View Ranch” (“The Villa”), located in Greece, Vatopedi village 63071, Vatopedi Beach hereinafter referred to as the “Manager”.
Art. 2. In the capacity referred to in Article 1, the Manager shall process as administrator the personal data of its customers – individuals, as well as the personal data of other individuals persons named below (“Data Subjects”/”You”), in accordance with the principles and rules provided for in the personal data protection legislation and this Policy.
Data subjects
Art. 3. (1) In connection with the services provided by the Manager, the Manager processes personal information regarding the following Data Subjects:
(a) natural persons visiting the website https://seaview-ranch.com/(the Website);
(b) natural persons who make reservations on their own behalf or on behalf of another natural or legal person at the contact details indicated on the Website;
(c) natural persons using the services provided by the Manager, including but not limited to accommodation, catering and related services, provision of premises for organizing conferences and other events, etc. sub., as well as natural persons representing or otherwise acting on behalf of legal entities that use these services;
(d) natural persons who, on their own behalf or on behalf of another person they represent, have sent inquiries (by e-mail, by calling), requests, signals, complaints or other correspondence;
(2) The services of the Manager can only be requested by able-bodied persons who have reached the age of 18.
Categories of personal data
Art. 4. The information (categories of personal data) that the Manager processes regarding the Data Subjects in accordance with this Policy may include:
(1) Data processed in connection with making a reservation for accommodation: names; contact details – e-mail address, telephone; details about the reservation, incl. period of accommodation/use of services, number of rooms (Bedrooms), number of guests (number of adults and number of children), special requirements and preferences of the guest (when explicitly indicated by the Subject in an inquiry, email correspondence or by phone);
(2) Data processed in connection with the provision of accommodation services:
(a) Identification data: guest names; date of birth; gender; nationality; national identification number (EGN for Bulgarian citizens), data from an identity document; signature.
(b) Contact details: telephone; email address; address.
(c) Information related to accommodation: reservation number, room (Bedroom) number; floor; dates of stay (arrival date and departure date); length of stay (number of overnight stays); preference for room type, etc.;
(d) Additional information related to accommodation services upon explicit request by the user of the services: special requirements and preferences.
(3) Data related to payments and invoicing: information on payment method (bank transfer, debit/credit card, etc.); information on payments due and made; bank information (bank, IBAN, bank account holder); currency of the payment made; credit/debit card number, validity and holder; CCV code.
(4) In cases where the services are requested by a person other than the Data Subject for the benefit of the Data Subject: information regarding in what capacity the Data Subject will use the services, by whom they are requested, by whom the payment will be made, etc. . (e.g. for accommodations organized by an employer, business partner, relative or close relative of the Data Subject, etc.).
(5) Unstructured content from conversations with employees of the administrator, as well as information contained in the inquiry form (“Book now” section of the Website).
(6) Data related to complaints, applications, requests, requests and signals submitted by customers (including in free text): unstructured information contained in the respective complaints, applications, requests, requests and signals.
(7) Cookies. The use of “cookies” is necessary for the functioning of the Website. A detailed description of the “cookies” used, their purpose and the information processed through them can be found in the Cookie Policy, available on the Website.
Video surveillance and security
Art. 5. (1) According to the requirements of the applicable legislation, the Manager implements security measures, which include the following technical and organizational means for access control and for ensuring physical security against encroachments on the buildings and objects and for the protection of life and health of citizens: security alarm systems and a video control system, performing 24-hour video surveillance and consisting of recording and storage devices.
(2) Video surveillance and video recording may be carried out in publicly accessible areas and premises in the building of the Villa and in those for which a special access regime is provided. There is no video surveillance in the guest rooms (Bedrooms), sanitary and hygiene rooms, the Kitchen, recreation rooms and places, etc. Data from video surveillance activities are stored in a monitoring room with limited access.
(3) Through information boards placed in a visible place, the Data Subjects and other visitors who may be filmed are notified of the use of technical means of monitoring and control and of any other relevant information in connection with the monitoring being carried out.
Direct marketing
Art. 6. (1) With the express consent of the Data Subject, the Manager may process the following personal data: names; telephone; email address; information about the type and volume of used and preferred services provided by the Manager and other data, expressly mentioned in the relevant consent, for the purposes of direct marketing, including offering other services, conducting surveys, surveys with a view to improving the quality of the services provided, etc. under. according to the scope of the specifically given consent.
(2) When personal data are processed for the purposes of direct marketing, the Data Subject has the right to object to this processing of personal data at any time. In these cases, the processing of personal data for these purposes is terminated.
(3) The Manager does not perform profiling for the purposes of direct marketing.
Grounds for processing personal data.
Art. 7. The Manager processes the information described above for the purposes provided for in this Policy and in the general terms and conditions (agreement) for the use of the relevant services that it provides on the following grounds:
- when necessary to comply with statutory obligations applicable to the Manager;
(b) when it is necessary to fulfill the contracts concluded with the Manager or to take steps at the request of the Data Subject before concluding a contract;
(c) when it is necessary for the purposes of the legitimate interests of the Manager or of third parties;
(d) based on the Subject’s express consent to process his data.
Art. 8. The purposes of personal data processing by the Manager, related to compliance with legal obligations, include:
(1) keeping a register for the accommodated tourists and submitting information from it to the competent authorities in accordance with the law;
(2) address registration of foreigners according to the requirements of the applicable legislation;
(3) withholding and payment of tourist tax;
(4) activities related to the development and implementation of counter-terrorism measures;
(5) service of signals, complaints, requests for exercise of rights and the like, as well as claims and commercial warranties (if applicable), including the preparation of responses thereto;
(6) accounting, invoicing and reporting of payments received and made in accordance with the current tax and accounting legislation;
(7) other activities for the fulfillment of legal obligations (tax, accounting, regulatory, licensing, etc.) of the Manager, related to providing information to competent authorities and providing assistance during inspections by competent authorities.
Art. 9. The purposes of processing personal data by the Manager, related to and/or necessary for the performance of contracts or to take steps at the request of the Data Subject before concluding a contract with the Manager, include:
- accepting, administering and processing reservations and canceling them;
- customer service;
(3) carrying out communication related to the services provided;
(4) administration and receipt of payments for services provided, incl. from a distance;
(5) providing a guarantee for reservations made and for the payment of accommodation and additionally requested services;
(6) financial and accounting activities and administration, processing and collection of payments due for services provided;
(7) refund of transferred amounts;
(8) ensuring an individual approach to the provision of services, consistent with the preferences stated by their users.
Art. 10. The purposes of processing personal data related to the legitimate interests of the Manager or third parties include:
(1) Legitimate interest – (1.1.) exercising and protecting the legal rights and interests of the Manager; (1.2.) assistance in exercising and protecting the legal rights and interests of customers, other persons associated with the Manager, employees of the Manager, persons processing personal data on behalf of the Manager, to commercial partners of the Manager:
(a) establishment, exercise or defence of legal claims of the above-mentioned persons under item (1.1) and item (1.2), incl. and by court order, including filing of complaints, reports, etc. under. to the competent authorities;
(b) video surveillance and access control in order to protect the property of the Manager, prove the fulfilment of the applicable requirements, ensure physical security against encroachments on the building and objects and protect the life and health of citizens;
(c) taking actions to suspend the provision of services in case of refusal of payment, violation of the internal rules and policies established by the Manager, etc.;
(d) administration and service of received complaints, alerts, requests, etc.;
(e) collection of receivables owed to the Manager, including by compulsory order and/or by assignment to third parties, as well as transfer of receivables to third parties (assignments) according to the procedure established by law;
(f) issuing notarial invitations.
(2) Legitimate interest – analysis, planning and improving the quality of the services provided by the Manager:
(a) maintaining a copy of the data from the internal information system, in relation to the current state of the Villa (occupancy, obligations, etc.) in the event of a breakdown of the information systems;
(b) receiving, processing and preparing responses to submitted applications, requests, etc. sub., not related to complaints and complaints about the used Services;
(c) customer and service user satisfaction survey;
(d) control, analysis and optimization of business processes to improve the quality of services.
(3) Legitimate interest – ensuring the normal functioning and use of the Website:
(a) maintenance and administration of the Website;
(b) detecting and resolving technical problems with the functionalities of the Website;
(c) taking measures against malicious actions against the security and normal functioning of the Website.
(4) Legitimate interest – accommodation services:
(a) administration and management of the services provided by the Manager;
(b) management and control of the quality of the services provided;
(c) receiving feedback on the services provided.
Art. 11. The purposes of processing personal data based on consent given by the Data Subject include:
(1) Sending marketing and advertising messages for services, special offers, packages, events and others;
(2) Surveys and obtaining feedback regarding the quality of the Services;
(3) Sending newsletters;
(4) Other purposes for which consent has been specifically granted by the Data Subject.
Provision of personal data and consequences of refusal to provide them to the Manager
Art. 12. (1) the Manager clearly indicates, where applicable and in an appropriate manner, whether the indication/provision of relevant data and/or documents is mandatory or constitutes a requirement necessary for the conclusion or performance of a contract, as well as the consequences of refusal to provide.
(2) If additional clarifications are needed, each Data Subject may request such on-site at the Manager facility or send an inquiry to the contact details specified in this Policy.
(3) The refusal to provide data and documents specified as mandatory may constitute an insurmountable obstacle to the provision of a service by the Manager, to the satisfaction of requirements and preferences, as well as to the fulfilment of submitted requests, applications, requests, alerts, etc. sub., which exempts the Manager from liability for non-performance.
(4) The refusal to provide data and documents or the provision of incorrect ones may lead to the impossibility of providing the relevant services or to the suspension of access to services provided by the Manager.
(5) Data subjects should not provide the Manager with any special categories of data within the meaning of Art. 9 and Art. 10 of the Regulation (namely: personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership, genetic data, biometric data, health data or data on the sex life or sexual orientation of the natural person and personal data relating to convictions and offences.
Other sources of personal data
Art. 13. (1) In some cases, the personal data processed by the Manager are not collected or received directly from the Data Subject to whom they relate, but from third parties such as:
(a) Persons representing, working for or otherwise cooperating with a Data Subject;
(b) Event organizers – regarding information about event participants;
(c) Business partners: online platforms for reservations, travel agents, other persons who provide intermediary services when making reservations or when requesting other services and similar to the Manager;
(d) Competent authorities.
(2) The persons under para. 1, letters (a)-(c) shall inform the Data Subjects whose data they provide to the Manager and to ensure that they provide the data based on a valid legal basis.
Categories of recipients of personal data
Art. 14. the Manager does not disclose personal data about the Data Subject to third parties, except in cases where and when:
(1) this is necessary to fulfil a legal obligation of the Manager:
(a) competent state, municipal or judicial authorities;
(b) auditors;
(2) this is expressly provided for in the Policy and/or in the general conditions (agreement) for the use of the relevant services that the Manager provides;
(3) this is necessary to provide the services of the Manager:
(a) banks and payment service providers;
(b) postal and courier service providers;
(c) commercial partners of the Manager such as: online booking platforms; travel agencies and other providers of travel or other ancillary services such as car rental, taxi and other transport services and the like;
(3) the Data Subject has given his express consent – the persons provided for in the relevant consent;
(4) this is necessary to protect the rights or legitimate interests of the Manager, third parties or the Data Subject;
Art. 15. (1) the Manager processes and stores information about the Data Subject for the purposes of and until the achievement of the relevant purposes for which it was collected and processed.
(2) The Manager, in accordance with its internal rules and procedures and the applicable legislation, processes and stores information about the Data Subject in the following terms:
2.1. Data for the register of accommodated tourists t, which include identification data of the accommodated persons and data related to accommodation; Information related to requested and used services for accommodation, events and restaurant services, incl. for canceled reservations for accommodation (as far as they are related to the refund of prepaid amounts and/or withholding of due amounts)
From the making of the relevant reservation/request up to 5 (five) years from the provision of the service/completion of the performance of the contract/cancellation of the reservation. In cases where the services are requested and used on the basis of a contract with continuous performance, the term begins to run from the final performance and/or termination of the contract.
2.2. Financial and accounting documents; invoices; authorization forms; other information related to tax and insurance control. Up to 10 (ten) years, counted from the beginning of the year following the one in which payment of the obligation for the respective year is due.
2.3. Unstructured communication, correspondence, complaints, alerts and 5 years.
In cases where the correspondence refers to a contract with continuous performance, the term begins to run from the final performance and/or termination of the contract.
2.4. System logs. Logs related to security, technical support, etc. (may contain information such as: date and time, IP address, URL, browser version and device information) – 1 year;
2.5. Video data 1 (one) week / 7 (seven) calendar days;
2.6. Data processed on the basis of the express consent of the Data Subject From the moment of giving consent until its withdrawal by the Data Subject.
The personal data specified in this Policy may be processed for a longer period of time than specified above, if this is necessary to achieve the goals set out in it or to protect the rights and/or legal interests (including by court order) of the Manager or if the current legislation provides for data processing for a longer period.
Rights of Data Subjects in relation to their personal data
Art. 16. In relation to the processing of personal data relating to him, each Data Subject has the following rights:
(1) Right to information – to receive information about the processing of his personal data by the Manager;
(2) Right of access:
(a) to obtain confirmation as to whether personal data relating to him are being processed;
(b) to obtain access to the processed personal data and to the detailed information about the processing and his rights.
(3) The right to correction – to request the correction or completion of his personal data, if the same are inaccurate or incomplete;
(4) The right to erasure – to request the erasure of his personal data, if the grounds for this provided for in the Regulation are present;
(5) Right to limit the processing of personal data – to demand from the Manager to limit the processing of his personal data within the framework of the provisions of the Regulation, if the grounds for this, provided for in the same, are present;
(6) Notification of third parties – right to request from the Manager to notify the third parties to whom his personal data were disclosed of any correction, deletion or restriction of the processing of his personal data, unless this is impossible or requires disproportionately large efforts from the Manager;
(7) Right to data portability – to receive the personal data concerning him and which he has provided to the Manager, in a structured, widely used and machine-readable format, and to transfer this data to another administrator without obstruction by the Manager.
The right to data portability applies when the following two conditions are met simultaneously:
(a) the processing is based on consent or a contractual obligation; and
(b) the processing is carried out in an automated manner.
(8) Rights in automated individual decision-making, including profiling – not to be subject to an automated decision based solely on automated processing (i.e. processing without human intervention), including profiling within the meaning of the Regulation, which gives rise to legal consequences for the Data Subject or similarly affects him to a significant extent, unless the grounds provided for in the Regulation are present and appropriate guarantees are provided to protect the rights and freedoms and legitimate interests of the Data Subject. Such guarantees are at least the right of human intervention on the part of the Manager, the right of the Data Subject to express his point of view and challenge the decision.
If such a decision, including profiling, is made against the Data Subject, for each specific case the Data Subject has the right and will receive from the Manager separately material information about the logic used, the meaning and the intended consequences of this processing for him, as and for the way of exercising the rights under this point.
(9) Right to withdraw consent to processing – when the processing of personal data is based solely on consent given by the Data Subject, the same may withdraw consent at any time. Such withdrawal does not affect the lawfulness of the processing based on the consent given until the time of its withdrawal;
(10) Right to object – The data subject has, at any time and on grounds related to his specific situation, the right to object to the processing of personal data concerning him, including against profiling within the meaning of the Regulation, which is based on public interest, exercise of official powers or the legitimate interests of the Manager or a third party. In these cases, the Manager terminates the processing of personal data, unless it proves that there are convincing legal grounds for the processing that take precedence over the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or protection of legal claims.
(11) Right to complain to a supervisory authority – every Data Subject has the right to lodge a complaint with a supervisory authority for personal data protection, in particular in the Member State (of the EU/EEA) of his/her habitual residence, place of work or the place of the alleged violation, if it considers that the processing of its personal data violates the provisions of the Regulation or other applicable requirements for the protection of personal data.
Art. 17. (1) The data subject may exercise the rights listed above by making a corresponding written request to the Manager – submitted personally by the data subject at the site of the Manager or to the email address mail specified in this Policy.
(2) The data subject may exercise the rights related to his personal data, personally or through a person expressly authorized by him (with a notarized power of attorney).
Limitations on Rights
Art. 18. The scope of the rights of the Data Subjects and the obligations of the Manager in relation to these rights may be limited by legislative measure of the law of the EU or of a Member State, which applies to the Manager.
Clarifications and additional information
Art. 19. The data subject may receive clarifications regarding the content and grounds for data processing, the manner of exercising the rights under this Policy, as well as any additional information regarding their rights in the processing of personal data from the Manager at the addresses, specified in Article 2 of this Policy. This Policy for the protection of personal data has been drawn up by the Manager in its capacity as a personal data administrator with a view to fulfilling its obligations to provide information to data subjects under Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC ( General Data Protection Regulation). The Policy may be amended and supplemented, and the current version will always be available and accessible on our Website.